Personal Information Protection Policy

Your personal information will be used for the following purposes:

1. (1) Target businesses
   Office building business, residential business, commercial business, building and power equipment consulting, planning, design, maintenance, operation and maintenance business, and other related businesses
2. (2) Purpose of use
   Regarding the business of item 1
   • For sales activities such as sending direct mail, pamphlets, etc., and soliciting via visits, telephone, and email
   • To fulfill contracts and provide information and services
   • For various operations such as providing information about after-sales services and products
   • To provide information about questionnaire surveys on customer satisfaction, etc.
   • For the purpose of analyzing customer trends as statistical information and conducting research and analysis on product development, etc.
   • To respond to accidents and disasters (including emergency contact) and for safety management

We will jointly use personal information to improve the convenience of our customer services.

1. (1) Items of personal information to be jointly used
   Name, contact information (telephone number, email address, etc.), organization name (company name, organization name, etc.), job title, and other information that can identify a specific individual
2. (2) Scope of joint users
   NTT Urban Solutions Group companies, etc. 
   (See the attached document "Scope of joint users")
3. (3) Purpose of use by joint users
   Purpose of use as described in 1 above
4. (4) Name and address of the person responsible for managing the personal information to be jointly used
   NTT Urban Development Corporation
   President and CEO Kou Ikeda
   Akihabara UDX, 4-14-1 Sotokanda, Chiyoda-ku, Tokyo

The joint use of information regarding our procurement partners will be in accordance with the Personal Information Protection Policy of NTT Corporation.
*Reference: "Regarding the joint use of information regarding business partners, etc. related to procurement" https://group.ntt/jp/protection/partners_procure.html

In addition to the above, we may share personal information with third parties. In such cases, we will notify you in advance or publish the following items on our website, etc.

1. ① Joint use
2. ②Items of customer personal information to be jointly used
3. ③ Scope of joint users
4. ④ Purpose of use by joint users
5. ⑤ The name and address of the person responsible for managing the customer's personal information, and in the case of a corporation, the name of its representative

If you have any questions or comments regarding your personal information, please contact the person in charge below.

We will respond to your requests for notification of the purpose of use of your retained personal data, requests for disclosure, correction, addition, deletion, suspension of use, or erasure of personal data, requests for disclosure of records of your personal information being provided to third parties, and requests for suspension of provision of your personal information to third parties in accordance with the provisions of the Personal Information Protection Act. Requests for disclosure, etc. will be handled by sending us the specified form by mail, fax, email, etc. In any case, please contact the inquiry desk listed above.

Please note that for inquiries from customers regarding their own retained personal data, we will first carry out our company's prescribed "identity verification" procedures and then ask you to follow our company's prescribed application procedures. Please also note that we will ask you to pay a handling fee (1,000 yen [tax included] per inquiry), so we appreciate your understanding and cooperation.

When handling customer personal information, we will take appropriate organizational, personnel, physical, and technical security measures.

1. (1) Organizational security control measures
   We have established an organizational management system that includes the establishment of a management system with committees and management officers in each organization, the development of internal regulations, the creation of statements such as management ledgers and process management tables, and continuous improvement.
2. (2) Personnel safety management measures
   We will inform and raise awareness among all employees who handle customer personal information, regardless of whether they are executives, full-time employees, or temporary workers, of the importance of protecting customer personal information, and will conclude confidentiality agreements with them and conduct the necessary audits and supervision to ensure their effectiveness.
3. (3) Physical safety control measures
   We will take various measures, such as controlling access to buildings and floors where customer personal information is handled, preventing theft, taking measures to protect customer personal information from damage due to fire or lightning strikes, and locking systems and documents when they are taken out, transported, or stored.
4. (4) Technical safety control measures
   We will take technical control measures such as access management including authentication, authority management, control and recording when accessing personal data, countermeasures against malicious software and viruses in the system, measures for transfer and transmission such as encryption and clarification of responsibility, and monitoring of information systems.
5. (5) Understanding the external environment
   When handling customer personal information in a foreign country, we will understand the systems for protecting personal information in that foreign country and take appropriate measures.

We may create anonymously processed information based on your personal information and provide it to third parties. In such cases, we will make the following items public on our website etc.

1. ①Items of personal information contained in the anonymously processed information created by our company
2. ②Items of personal information included in anonymously processed information provided to third parties
3. ③Method of providing anonymously processed information to third parties
4. ④ Details of safety control measures taken

When handling anonymously processed information, etc., we will take the safety control measures described above in 5. In addition, we will provide necessary and appropriate supervision to employees and contractors (including subcontractors) who handle anonymously processed information, etc.

We may create pseudonymized information based on your personal information. However, we will not provide this information to third parties unless required by law. When handling pseudonymized information, we will implement the safety management measures described in 5 above. We will also provide necessary and appropriate supervision to employees and contractors (including subcontractors) who handle pseudonymized information.

We handle personal information (information about living individuals that does not fall under personal information, pseudonymized information, or anonymously processed information, specifically website browsing history, location information, etc.) as follows:

1. (1) When we provide personal information
   When it is anticipated that a third party will acquire personal information as personal data, we will not provide such information to such third party without first confirming that we have obtained the customer's prior consent (if the third party is located in a foreign country, obtaining consent will include providing the customer with the name of the foreign country, its system for protecting personal information, the measures taken by the third party to protect personal information, and other information that should be useful to the customer), except in cases falling under any of the items of Article 27, Paragraph 1 of the Personal Information Protection Act.
2. (2) When we collect personal information as personal data
   When acquiring personal information as personal data, the Company will obtain the prior consent of the customer. However, if the person to whom the personal data is to be provided has already obtained consent from the customer, this may be substituted for obtaining prior consent.

When providing customer personal information or personal-related information to a third party in a foreign country (excluding countries that have personal information protection systems that are recognized as being at the same level as Japan in terms of protecting the rights and interests of individuals), we will take the following measures.

1. (1) Providing customer personal information to third parties in foreign countries
   1. ① By obtaining consent
      We may provide your personal information to a third party in a foreign country after notifying you of the following matters in advance and obtaining your consent.
      1. -Name of the foreign country to which the information will be provided
      2. -Personal information systems in the foreign country
      3. ・ Measures taken by third parties to protect personal information
      Please refer to the website of the Personal Information Protection Commission below for information on the "Personal Information Systems in the Foreign Country." (If the information is not listed on the website below, we will notify you individually.)
      [Personal Information Protection Commission website]
      https://www.ppc.go.jp/personalinfo/legal/kaiseihogohou/#gaikoku
   2. ② Methods based on the establishment of a third-party system in a foreign country
      In addition to the above (1), we may provide your personal information to third parties in foreign countries after taking the necessary measures to ensure that such third parties continue to implement appropriate measures.
2. (2) Providing personal information to third parties in foreign countries
   1. ① By obtaining consent
      In accordance with the provisions of 8.(1) above, we may provide personal information to third parties in foreign countries.
   2. ② Methods based on the establishment of a third-party system in a foreign country
      In addition to the above (1), we may provide personal information to third parties in foreign countries after confirming that we have obtained the consent set forth in 8.(1) above (excluding the confirmation that the information in parentheses has been provided) and taking the necessary measures to ensure the continued implementation of equivalent measures by third parties in foreign countries.